Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither required by law nor contractually, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This only applies if no other information is provided during the subsequent processing operations.
"Personal data" is all information that relates to an identified or identifiable natural person.

Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. There is an adequacy decision from the EU Commission for Canada. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not TADPF certified. This data transfer takes place on the basis of contractual obligations that are comparable to those of the EU Commission's standard contractual clauses.

Contact

Responsible
Contact us if you wish. The person responsible for data processing is: André Wittig, Am Sandweg 34, 01454 Radeberg Germany, +49(0)3528-48786-00, [email protected]

Initial contact from the customer by email
If you If you initiate business contact with us via email, we will only collect your personal data (name, email address, message text) to the extent provided by you. The data processing serves to process and answer your contact request.
If the contact serves to carry out pre-contractual measures (e.g. advice if you are interested in buying, preparing an offer) or concerns a contract that has already been concluded between you and us, this data processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Article 6 (1) (f) GDPR due to our overriding legitimate interest in processing and answering your request. In this case, you have the right, for reasons arising from your particular situation, to object at any time to this processing of your personal data based on Art. 6 Para. 1 lit. f GDPR.
We only use your email address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form
When you use the contact form, we only collect your personal data (name, email address, message text) to the extent provided by you. The data processing serves the purpose of establishing contact.
If the contact serves to carry out pre-contractual measures (e.g. advice if you are interested in purchasing, preparing an offer) or concerns a contract that has already been concluded between you and us, this data processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Article 6 (1) (f) GDPR due to our overriding legitimate interest in processing and answering your request. In this case, you have the right, for reasons arising from your particular situation, to object at any time to this processing of your personal data based on Art. 6 Para. 1 lit. f GDPR.
We only use your email address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Transfer to third parties (plugin use)
For the technical provision and management of the withdrawal function on our online presence, we use a third-party software solution as part of order processing Visonz GmbH, Richthofenstraße 29, 31137 Hildesheim
When you use the withdrawal function, your collected personal data will be transmitted to the servers of the above-mentioned third-party providers.

Collection and processing when sending images by email
You have the option of sending us images by email in connection with ordering a personalized product.
When you submit your images, we may only collect your personal data (image of an identifiable person) to the extent provided by you. The data processing serves the purpose of creating personalized products. The image sent serves as a template for the product and is used for this (e.g. T-shirt printing). The processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR and is necessary for the fulfillment of a contract with you.
Your data will not be passed on. 
We only use the image you send as part of the provision of the service. Your data will then be deleted in compliance with statutory retention periods unless you have consented to further processing and use.

Customer account      Orders      

Customer account
When you open a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is carried out on the basis of Article 6 Paragraph 1 Letter a GDPR with your consent. You can withdraw your consent at any time by notifying us, without this affecting the lawfulness of the processing carried out based on your consent before its withdrawal. Your customer account will then be deleted.

Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. There is an adequacy decision from the EU Commission for Canada. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not TADPF certified. This data transfer takes place on the basis of contractual obligations comparable to those of the EU Commission's standard contractual clauses.

Reviews       Advertising      


Data collection when writing a comment or rating
When commenting/rating an article or post, we only collect your personal data (name, e-mail address, comment text) to the extent provided by you. The processing serves the purpose of enabling comments/ratings and displaying comments/ratings. 

For the purpose of verifying your rating/comment, we also collect the following data: Order number, , , .

By submitting the comment/rating, you consent to the processing of the transmitted data. Processing is carried out on the basis of Article 6 Paragraph 1 Letter a GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on your consent before its withdrawal. Your personal data will then be deleted.

When your comment/rating is publishedthe name you provided and the email address you providedpublished.

In addition, when you submit a comment/rating, your IP address will be stored for the purpose of preventing misuse of the comment or rating function and ensuring the security of our information technology systems. By submitting the comment/review, you consent to the processing of the transmitted data. The processing is carried out on the basis of Article 6 Paragraph 1 Letter a GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on your consent before its withdrawal. Your IP address will then be deleted.

Use of Judge.me
We use the rating system "Judge.me" from Judge.me Ltd (c/o Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB; "Judge.me") on our website.
Judge.me allows us to collect customer reviews and display them on our website to give you an insight into the quality of our services.
After placing an order, you can receive an invitation to submit a review from us or Judge.me and then submit a review. The following data may be processed by us or Judge.me, among others: email address, name, telephone number, address, information about your device (IP address, information about your web browser and the operating system used), information about the product purchased or the service used (order number, product details), the content of your review and the star rating you gave, your product photos or videos (if you have attached these to your product review). This data may also be used to verify your rating.
Judge.me uses technologies such as cookies.
Your data may be transferred outside the EU to the United Kingdom. There is an adequacy decision from the EU Commission for the United Kingdom.
Your data may be transferred to the USA. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Judge.me is not certified according to the TADPF. This data transfer takes place on the basis of special contracts that have been approved for use in the United Kingdom and which offer the same protection that personal data has in the United Kingdom.
The use of cookies or comparable technologies takes place with your consent on the basis of Section 25 Paragraph 1 Sentence 1 TDDDG in conjunction with Article 6 Paragraph 1 Letter a GDPR. The processing of your personal data takes place with your consent on the basis of Art. 6 Para. 1 lit. a GDPR, provided you have expressly agreed to the transfer of your data and to receiving the request for evaluation. You can withdraw your consent at any time without affecting the lawfulness of the processing based on your consent before its withdrawal.
Further information on data protection when using Judge.me can be found at: https://judge.me/privacy.

Use of the Trusted Shops rating system (Trustbadge)
We use the rating system of Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne on our website; “Trusted Shops”).
Trusted Shops and we are jointly responsible for the collection of your data when you use the service and the transmission of this data to Trusted Shops. The basis for this is an agreement between us and Trusted Shops on the joint processing of personal data.
Thereafter, we and Trusted Shops are equally responsible for fulfilling the obligations under the GDPR, in particular for fulfilling the information obligations in accordance with Articles 13, 14 GDPR and for granting the rights of those affected in accordance with Articles 15 - 21 GDPR. Further information can be found at https://help.etrusted.com/hc/de/article_attachments/4422901015569.
Trusted Shops enables us to obtain customer reviews and post them via the “Trustbadge”. on our website to give you an insight into the quality of our services.
After placing an order, you can receive an invitation to submit a review from us or Trusted Shops and then submit a review. The following data is processed by us or Trusted Shops: email address, order information (order total, order number, product purchased if applicable). If necessary, this data can also be used for the purpose of verifying your rating.
When you access our website and display the trust badge, we or Trusted Shops also process the following data: your IP address, date and time of access, amount of data transferred and the requesting provider.
Processing is carried out on the basis of Article 6 Paragraph 1 Letter a of the GDPR with your consent, provided that you have expressly agreed to the transfer of your data and to receiving the request for evaluation. You can withdraw your consent at any time without affecting the lawfulness of the processing based on your consent before its withdrawal.
Further information on data protection at Trusted Shops can be found at: https://www.trustedshops.de/impressum-datenschutz/#datenschutz.

Use of the E-mail address for sending newsletters
We use your e-mail address to send information and offers via newsletter, provided you have expressly agreed to this. The data processing serves the sole purpose of advertising. For this purpose, we process your email address and, if applicable, other data that you voluntarily provided when registering for our newsletter.
The processing is carried out on the basis of Art. 6 Para. 1 lit. a GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing based on your consent prior to its withdrawal.
You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list. Despite being removed from the distribution list, we can continue to store your email address in a so-called blacklist to prevent you from receiving newsletter emails from us in the future. This storage is based on Article 6 Paragraph 1 Letter f of the GDPR out of our and your legitimate interest in preventing your email address from being used again to send our newsletter. You have the right to object to this processing of personal data concerning you at any time for reasons arising from your particular situation.

Use of the email address for sending direct advertising
We use your email address, which we received as part of the sale of a good or service, to electronically send advertising for our own goods or services that are similar to those that you have already purchased from us, unless you have objected to this use. Providing the email address is necessary for the conclusion of the contract. Failure to provide it will result in no contract being concluded. The processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in direct advertising. You can object to this use of your email address at any time by notifying us. The contact details for exercising your objection can be found in the legal notice. You can also use the link provided for this purpose in the advertising email. There are no costs for this other than the transmission costs according to the basic tariffs.

Use of Klaviyo
We use the service of Klaviyo Inc. (125 Summer St Floor 7, Boston, MA 02111, USA; “Klaviyo”)  to send the newsletter as part of order processing.
We provide the information you provide during the newsletter registration (e-mail address, if necessary and last name) to Klaviyo. The data processing serves the purpose of sending the newsletter and its statistical evaluation.
In order to evaluate newsletter campaigns, the newsletters sent contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked on any integrated links. In this context, we collect your personal data such as IP address, browser type and device as well as the time. Usage profiles can be created from this data under a pseudonym. The data collected will not be used to identify you personally. The data collected is only used for statistical evaluation to improve newsletter campaigns.
Your data is usually transmitted to Klaviyo servers in the USA and stored there. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo has certified itself according to the TADPF and is therefore obliged to comply with European data protection principles.
The processing of your personal data is based on Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in a targeted, advertising-effective and user-friendly newsletter system. You have the right, for reasons arising from your particular situation, to object to this processing of personal data concerning you at any time.
More information about data protection at Klaviyo can be found at https://www.klaviyo.com/legal/privacy-notice and at https://www.klaviyo.com/legal/data-processing-agreement. 

Shipping service provider      

Passing on the email address to shipping companies for information about the shipping status
We pass on your email address to the transport company as part of the contract processing, provided you have expressly agreed to this during the ordering process. The purpose of the transfer is to inform you by email about the shipping status. Processing is carried out on the basis of Article 6 Paragraph 1 Letter a GDPR with your consent. You can withdraw your consent at any time by notifying us or the transport company, without affecting the lawfulness of the processing carried out based on your consent before its withdrawal.

Payment service providers       Credit information      

Use of PayPal
We use the PayPal payment service provided by PayPal (Europe) S.à.r.l on our website. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; “PayPal”). The data processing serves the purpose of being able to offer you payment via the payment service. By selecting and using payment via PayPal, the data required for payment processing will be transmitted to PayPal in order to be able to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR.

All PayPal transactions are subject to the PayPal data protection declaration. You can find these at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of PayPal Express
We use the PayPal Express payment service from PayPal (Europe) S.à.r.l. on our website. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; “PayPal”). The data processing serves the purpose of being able to offer you payment via the PayPal Express payment service. In order to integrate this payment service, it is necessary for PayPal to collect, store and analyze data (e.g. IP address, device type, operating system, browser type, location of your device) when you access the website. Cookies can also be used for this purpose. The cookies enable your browser to be recognized.
The processing of your personal data is based on Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in a customer-oriented offer of different payment methods. You have the right to object to this processing of your personal data at any time for reasons arising from your particular situation.
By selecting and using PayPal Express, the data required for payment processing will be transmitted to PayPal in order to be able to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR. Further information on data processing when using the PayPal Express payment service can be found in the associated data protection declaration at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.

Use of PayPal Check-Out
We use the Payment service PayPal Check-Out from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; “PayPal”). The data processing serves the purpose of being able to offer you payment via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or “Pay later” via PayPal, the data required for payment processing will be transmitted to PayPal in order to be able to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR.

Cookies can be stored here, which enable your browser to be recognized. The resulting data processing takes place on the basis of Article 6 Paragraph 1 Letter f of the GDPR due to our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object to this processing of personal data concerning you at any time for reasons arising from your particular situation.

Credit card via PayPal, direct debit via PayPal & “Pay later” via PayPal
For individual payment methods such as credit card via PayPal, direct debit via PayPal or “Pay later” via PayPal, PayPal reserves the right to provide credit information based on mathematical and statistical methods, if necessary Use of credit agencies to obtain information. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of non-payment to make a balanced decision about the establishment, implementation or termination of the contractual relationship. The credit report can contain probability values ​​(score values) that are calculated on the basis of scientifically recognized mathematical-statistical methods and whose calculation includes, among other things, address data. Your interests worthy of protection will be taken into account in accordance with the legal provisions. The data processing serves the purpose of checking your creditworthiness to initiate a contract. The processing is carried out on the basis of Article 6 Paragraph 1 Letter f of the GDPR due to our overriding legitimate interest in protecting against non-payment if PayPal makes advance payments. 
You have the right, for reasons arising from your particular situation, to object at any time to this processing of your personal data based on Art. 6 Para. 1 lit. f GDPR by notifying PayPal. The provision of the data is necessary for the conclusion of the contract with the payment method you require. Failure to provide this means that the contract cannot be concluded with the payment method you have chosen.

Third-party providers
If you pay using a third-party payment method, the data required for payment processing will be transmitted to PayPal. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR. To carry out this payment method, PayPal may then pass on the data to the respective provider. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR. Local third parties can be, for example:

• Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
• Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Purchase on account via PayPal
When paying via the purchase on account payment method, the data required for payment processing is first transmitted to PayPal. To carry out this payment method, PayPal will then transmit the data to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to be able to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR. Ratepay may carry out a credit report based on mathematical-statistical methods (probability or score values) using credit agencies according to the process described above. The data processing serves the purpose of checking your creditworthiness to initiate a contract. The processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR due to our overriding legitimate interest in protecting against payment default if Ratepay makes advance payments. Further information on data protection and which credit agencies use Ratpay can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/. 

Further information on data processing when using PayPal can be found in the associated data protection declaration at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Data collection and processing during credit checks
If we are in advance payment, e.g. B. when paying by invoice or direct debit, we reserve the right, if necessary, to provide a credit report based on mathematical and statistical methods using the SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, to catch up. To do this, we transmit the personal data required for a credit check and use the information received about the statistical probability of non-payment to make a balanced decision about the establishment, implementation or termination of the contractual relationship. The credit report can contain probability values ​​(score values) that are calculated on the basis of scientifically recognized mathematical-statistical methods and whose calculation includes, among other things, address data. Your interests worthy of protection will be taken into account in accordance with the legal provisions. The data processing serves the purpose of checking your creditworthiness to initiate a contract. The processing is carried out on the basis of Article 6 Paragraph 1 Letter f of the GDPR due to our overriding legitimate interest in protecting against non-payment if we make advance payments.For reasons arising from your particular situation, you have the right to object at any time to this processing of your personal data based on Article 6 Paragraph 1 Letter f of the GDPR by notifying us.The provision of the data is necessary for the conclusion of the contract with the payment method you require. Failure to provide this means that the contract cannot be concluded using the payment method you have chosen.

Use of Shopify Payments
We use the payment service “Shopify Payments” from Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) on our website. In this case, payment processing is carried out by the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; "Stripe"). The data processing serves the purpose of being able to offer you payment via the Shopify Payments payment service. By selecting and using a corresponding “Shopify Payments” payment method, the data required for payment processing will be transmitted to Stripe in order to be able to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Article 6 Paragraph 1 Letter b of the GDPR.
Stripe reserves the right, if necessary, to obtain credit information based on mathematical-statistical procedures using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of non-payment to make a balanced decision about the establishment, implementation or termination of the contractual relationship. The credit report can contain probability values ​​(score values) that are calculated on the basis of scientifically recognized mathematical-statistical methods and whose calculation includes, among other things, address data. Your interests worthy of protection will be taken into account in accordance with the legal provisions. The data processing serves the purpose of checking your creditworthiness to initiate a contract. The processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR for our overriding legitimate interest in protecting against payment default if Stripe makes advance payments.
You have the right, for reasons arising from your particular situation, to object at any time to this processing of personal data concerning you based on Art. 6 Para. 1 lit. f GDPR by notifying Stripe. The provision of the data is necessary for the conclusion of the contract with the payment method you require. Failure to provide this means that the contract cannot be concluded using the payment method you have chosen.
For more information on data processing when using the Shopify Payments payment service, please see Shopify's data protection declaration at: https://www.shopify.com/legal/privacy.
For more information on data processing when processing payments via the payment service provider Stripe, please see Stripe's data protection declaration at: https://stripe.com/de/privacy.

Use of Consentmanager
We use the consent management tool Consentmanager from Consentmanager AB (Håltegelvägen 1b, 72348 Västerås, Sweden; "Consentmanager") on our website.
The tool enables you to grant consent to data processing via the website, in particular the setting of cookies, and to make use of your right to withdraw for consent that has already been given.
The data processing serves the purpose of obtaining and documenting the necessary consent to data processing and thus complying with legal obligations.
Cookies can be used for this. Among other things, The following information is collected and transmitted to Consentmanager: date and time of page access, information about the browser and device you use, anonymized IP address, opt-in and opt-out data. A WeiThis data will not be passed on to other third parties.
Data processing is carried out to fulfill a legal obligation based on Article 6 Paragraph 1 Letter c GDPR.
You can find further information about data protection at Consentmanager at:https://www.consentmanager.net/de/datenschutz/

Use of the Shopify Consent Tool (Shopify Privacy & Compliance)
We use the consent tool “Shopify Privacy & Compliance” from Shopify International Ltd. on our website. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify"). Shopify is a company affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The tool allows you to give consent to data processing via the website, in particular the setting of cookies, and to make use of your right to withdraw for consent that has already been given. The data processing serves the purpose of obtaining and documenting the necessary consent for data processing and thus complying with legal obligations. Cookies can be used for this. User information, including your IP address, is collected and transmitted to Shopify.
Your data may be transferred to third countries outside the EU, in particular Canada and the USA, and processed there. There is an adequacy decision from the EU Commission for Canada. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not TADPF certified. This data transfer takes place on the basis of contractual obligations that are comparable to those of the EU Commission's standard contractual clauses.
Data processing is carried out to fulfill a legal obligation based on Article 6 Paragraph 1 Letter c GDPR.
For more information about data protection at Shopify, seehttps://www.shopify.com/legal/privacy.


Analytics      Advertising tracking       Communication


Use of Google Analytics 4
We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.
The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. 
The following information can be collected, among other things: IP address, date and time of page access, click path, information about the browser you use and the device you use, pages visited, referrer URL (website through which you accessed our website), location data, purchasing activities. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices and any other data that Google has about you.

Your IP address will first be shortened by us on our own servers. Google only receives pseudonymized data.

Google uses technologies such as cookies, web storage in the browser and tracking pixels that enable an analysis of your use of the website. The use of cookies or comparable technologies takes place with your consent on the basis of Section 25 Paragraph 1 Sentence 1 TDDDG in conjunction with Article 6 Paragraph 1 Letter a GDPR. 

The processing of your personal data takes place with your consent on the basis of Art. 6 Para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out based on your consent before its withdrawal.

We use the advanced implementation of Advanced Consent Mode. Even if consent is not given, user data is transmitted to Google in the form of “pings”. These pings can contain, among other things, the following information: IP address to derive the IP country (the IP address is not logged), date and time of the page view, URL of the pages visited, user agent, referrer URL (website through which our website was accessed) or information about the triggering of website events such as a conversion. Based on this information, Google models user data in order to be able to carry out a comprehensive usage analysis despite the refusal of consent.

The information generated in this way about your use of this website is usually transmitted to a Google server in the USA and stored there. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and is therefore committed to complying with European data protection principles. Both Google and US state authorities have access to your data.

For more information about terms of use and data protection, please see https://policies.google.com/technologies/partner-sites at https://policies.google.com/privacy?hl=de&gl=deand underhttps://business.safety.google/privacy/.

How to use Shopify statistics
We use the statistics and analysis functions of Shopify International Ltd on our website. (Victoria Buildings,2nd Floor,1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as part of order processing. Shopify is an affiliated company of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The data processing serves the purpose of analyzing this website and its visitors. For this purpose, data is stored for marketing and optimization purposes and made available in reports, analyzes and statistics. The following device information is collected and processed, among other things: information about the web browser, the IP address, the time zone and some of the cookies that are installed on your device. When you navigate the website, information about the websites or products you visit, the referrer URL (the website from which you accessed our website), and information about how you interact with the website are also collected. Technologies such as cookies, web beacons, tags and pixels (electronic files used to collect information about how you navigate the website) are used for this purpose.
Your data may be transferred to third countries outside the EU, in particular Canada and the USA, and processed there. There is an adequacy decision from the EU Commission for Canada. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not TADPF certified. This data transfer takes place on the basis of contractual obligations that are comparable to those of the EU Commission's standard contractual clauses.
The use of cookies or comparable technologies takes place with your consent on the basis of Section 25 Paragraph 1 Sentence 1 TDDDG in conjunction with Article 6 Paragraph 1 Letter a GDPR. Your personal data will be processed with your consent on the basis of Art. 6 Para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing based on your consent before its withdrawal.
You can find more information about data protection at Shopify at https://www.shopify.com/legal/privacy, information about the order processing contract at https://www.shopify.com/de/legal/dpa as well as information about the cookies used at https://www.shopify.com/de/legal/cookies.

Use of Microsoft Clarity
We use the analysis tool “Microsoft Clarity” from Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; “Microsoft”) on our website. Microsoft is a company affiliated with Microsoft Corporation (One Microsoft Way, Redmond, Washington 98052, USA).
The data processing serves the purpose of needs-based design, optimization and analysis of our website. The tool is used to randomly record the movements of site visitors on the website. This creates a log of mouse movements, scrolling behavior, time spent on the website and clicks (so-called heatmap).
Cookies or comparable technologies are used for this purpose. The following information can be collected, among other things: IP address, time of access, click path, information about the device you are using (device type, screen size and resolution, unique device identifier, operating system), information about the browser you are using (browser type and browser version), location data, preferred language for displaying the website, subpages visited, length of stay, content viewed, website or file requested.
User profiles are created from this data under a pseudonym. The data is not used to personally identify the visitor to the website and is not combined with personal data of the bearer of the pseudonym. Microsoft is contractually prohibited from selling the collected data to other third parties.
Your data may be transferred to the USA. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Microsoft has certified itself according to the TADPF and is therefore obliged to comply with European data protection principles.
The use of cookies or comparable technologies takes place with your consent on the basis of Section 25 Paragraph 1 Sentence 1 TDDDG in conjunction with Article 6 Paragraph 1 Letter a GDPR. Your personal data will be processed with your consent on the basis of Art. 6 Para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing based on your consent before its withdrawal.
Detailed information about the cookies used and their function can be found at https://learn.microsoft.com/en-us/clarity/setup-and-installation/cookie-list. Information on how long the information collected is stored can be found at https://learn.microsoft.com/en-us/clarity/setup-and-installation/data-retention. For more information about data protection when using Microsoft Clarity, see https://learn.microsoft.com/en-us/clarity/faq#privacy, https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data and https://clarity.microsoft.com/terms. General information on data protection at Microsoft can be found at https://privacy.microsoft.com/de-de/privacystatement.

Use of Google AdSense
We use the AdSense function of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website. The data processing serves the purpose of renting out advertising space on the website and targeting website visitors with interest-based advertising. Using this function, visitors to the provider's website are shown personalized, interest-based advertising ads from the Google Display Network. Google uses cookies that enable analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. The EU Commission has an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Googlehas certified itself according to the TADPF and is therefore obliged to comply with European data protection principles. Google may transfer this information to third parties if this is required by law or if third parties process this data on behalf of Google. Under no circumstances will Google associate your IP address with other Google data.
The use of cookies or comparable technologies takes place with your consent on the basis of Section 25 Paragraph 1 Sentence 1 TDDDG in conjunction with Article 6 Paragraph 1 Letter a GDPR. Your personal data will be processed with your consent on the basis of Art. 6 Para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing based on your consent prior to its withdrawal.
You can find further information and Google's data protection declaration at: https://www.google.com/policies/technologies/ads/, https://www.google.de/policies/privacy/ and https://business.safety.google/privacy/

Plug-ins and miscellaneous

Inclusion of the dealer association member logo
The dealer association member logo (Dealer Association e.V., Kohlgartenstraße 11 - 13, 04315 Leipzig) is integrated into our website. When you access our website, the browser used on your device automatically sends information to the dealer association server. This information is temporarily stored in a so-called server log file for 7 days. The following information is recorded without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the retrieved file,
• Website from which access is made (referrer URL),
• browser used and, if applicable, the operating system of your computer as well as the name of your access provider. 

The temporary storage of the IP address by the system is necessary to enable delivery of the website. To do this, the IP address must remain stored for the duration of the session. The data is stored in log files to ensure the functionality of the website. The data is also used to optimize the website and to ensure the security of the information technology systems. This data is not stored together with other personal data. The legal basis for data processing is Article 6 Paragraph 1 Sentence 1 Letter f of the GDPR.

Inclusion of the logo of the “FairCommerce” initiative
The logo of the “FairCommerce” initiative (Merkerbund e.V., Kohlgartenstraße 11 - 13, 04315 Leipzig) is integrated into our website. When you access our website, the browser used on your device automatically sends information to the dealer association server. This information is temporarily stored in a so-called server log file for 7 days. The following information is recorded without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the retrieved file,
• Website from which access is made (referrer URL),
• browser used and, if applicable, the operating system of your computer as well as the name of your access provider.

The temporary storage of the IP address by the system is necessary to enable delivery of the website. To do this, the IP address must remain stored for the duration of the session. The data is stored in log files to ensure the functionality of the website. The data is also used to optimize the website and to ensure the security of the information technology systems. This data is not stored together with other personal data. The legal basis for data processing is Art. 6 Para. 1 S. 1 lit. f GDPR.

Rights of those affected and storage period

Duration of storage
After the contract has been fully processed, the data will initially be stored for the duration of the warranty period, then taking into account statutory retention periods, in particular tax and commercial law, and then deleted after the deadline has expired, unless you have consented to further processing and use.

Rights of the data subject
If the legal requirements are met, you are entitled to the following rights in accordance with Articles 15 to 20 of the GDPR: right to information, to rectification, to deletion, to restriction of processing, to data portability.
In addition, according to Art. 21 Para. 1 GDPR, you have the right to object to processing based on Art. 6 Para. 1 f GDPR, as well as to processing for the purpose of direct advertising.

Right to lodge a complaint with the supervisory authority
According to Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that your personal data is not being processed lawfully.

You can lodge a complaint with, among other things, the supervisory authority responsible for us, which you can reach using the following contact details:

Saxon data protection and transparency officer
Maternistraße 17
01067 Dresden
Tel.: +49 351 85471101
Fax: +49 351 85471109
E-mail: [email protected]

Right to object
The personal data processing listed here is based on Based on our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR, you have the right to object to this processing at any time with future effect for reasons arising from your particular situation.
After the objection has been made, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or if the processing is intended to assert, exercise or defend legal claims is used.

If personal data is processed for direct advertising purposes, you can object to this processing at any time by notifying us. After an objection has been made, we will stop processing the data concerned for the purpose of direct advertising.

---

Supplementary data protection information on “What’s good for you today?”

As of this addition: September 13, 2026. The following information also explains the processing of personal data in our care, advice, learning and community offerings. They refer to “Your Routine”, “Skin Type Test”, “AI Skin Analysis”, “Ask Thu”, “Before & After / Skin Stories”, “Quick-K”, “K-Beauty Academy”, “Cozy K-Game”, “Compare Products”, “Suggest a Product” as well as our editorial information and video offers. The respective sections above also apply to general website operations, customer accounts, orders, payment processing and separately used analysis and advertising services.

1. Voluntary use and information about your skin

The use of these offers is voluntary. A purchase is also possible without a skin type test, saved care routine, photo analysis, advice or publication of a skin story. The information required for a selected function can be found in the respective input fields and the following information. Without the required information, we may not be able to provide the function in question; This does not create any obligation to provide other voluntary information.

Information about intolerances, illnesses, skin reactions as well as photos and information derived from them may contain health data within the meaning of Art. 9 Para. 1 GDPR. For the processing of such data for the voluntary consulting, analysis, storage or publication purposes described here, in addition to the general legal basis, express consent is required in accordance with Article 9 (2) (a) GDPR. This must relate to the data in question and the specific purpose. Merely reading this privacy policy, general cookie consent, newsletter registration or purchase does not replace this express consent.

Please only provide information and images that are necessary for your request. In particular, avoid medical documents, information about other people and photos in which other people can be identified. The offers serve as cosmetic guidance and do not replace a medical examination or treatment. This classification of content does not exclude the processing of specially protected health data in individual cases.

2. Skin type test, product selection and product comparison

During the skin type test, your selected observations about skin feel and sensitivity are evaluated in your browser's RAM. The evaluation is carried out using defined response weights and selection rules; the test does not use photo AI. Its own function does not transmit your answers to our routine database, does not create a customer profile and does not permanently save the test result in the browser. When you reload or close the page, this test status is lost.

For displayed product options and product comparisons, public product information is retrieved from our shop, in particular product names, variants, prices, availability, ingredients and application instructions. The usual technical connection data is required. The product comparison processes the selected products, categories and filters in the browser; he does not keep a separate permanent comparison history in the customer account. The legal basis for the technical provision and individual evaluation requested by you is Article 6 Paragraph 1 Letter b GDPR, provided there is a corresponding usage relationship, and Article 6 Paragraph 1 Letter f GDPR with our legitimate interest in providing the selection aid you have accessed. Section 1 also applies to any health data.

3. “Your routine” and voluntary storage in the customer account

The routine planner processes your selection of skin type, care needs, time of day, scope and products to put together a care routine. Without explicit saving, the routine planner will not create a permanent routine profile in your customer account. If you confirm voluntary storage while logged in, the selected skin type, morning, evening or overall routine, number of steps, product and variant identifiers, existing or omitted steps and the respective storage times will be assigned to your Shopify customer account. The data is stored in designated customer fields on Shopify and in the database of our own routine application.

In addition, the customer ID, versions of the profile, technical process identifiers as well as the time, scope and text version of the storage, withdrawal or deletion decision are processed for secure assignment and proof of processing. Voluntary account storage is based on Art. 6 Para. 1 lit. a GDPR; If health data is affected, the express consent explained in Section 1 is also required. Consent to storage does not constitute registration for the newsletter and does not in itself allow the routine to be used for personalized advertising.

You can delete saved routines using the function provided and withdraw your consent at any time in the future. Alternatively, just send a message to [email protected]. Simply not checking the save option on a later visit will not delete an already saved profile. The removal of a routine does not automatically affect orders, other tool data or an independently existing newsletter subscription.

When you add products from a routine to your shopping cart, the selected variants, quantities and the marking as a morning, evening or overall routine are passed on to Shopify. This identification can be used during order processing, for example for appropriate application instructions. The routine shopping cart call does not transmit a skin photo or a complete skin profile as an order item property. Processing for the shopping cart and order is carried out in accordance with Art. 6 Paragraph 1 Letter b GDPR.

4. Quick-K and voluntary sharing

Quick-K processes your product selection, assignment to your morning or evening routine and missed steps in the browser. It does not maintain its own customer profile or permanent local storage. When you add it to your shopping cart, Shopify processes the selected variants and quantities to prepare your order in accordance with Article 6 (1) (b) GDPR.

The share function creates a link whose fragment contains the selected variants, time of day and omitted steps. Anyone who receives this link can access the product selection contained therein. The fragment is not sent to our web server during normal page retrieval; It is still part of the shared link and is not confidential access protection. An optionally entered recipient name will be used for the message body you prepared.

If you choose “WhatsApp”, the prepared message text and link will be passed to the opened WhatsApp service. This is done through your selection of the share function; no message will be sent without your further action on the service. For subsequent processing by WhatsApp Ireland Limited and other companies involved, WhatsApp's data protection information applies. Instead, you can copy the link and decide for yourself whether and to whom you pass it on. The sharing function you have requested is provided in accordance with Article 6 (1) (b) GDPR.

5. “Ask Thu” – personal advice with optional photos

For a consultation request, we process your concern, your question and your e-mail address as well as the information you have voluntarily added, such as your first name, skin type, sensitivity, care requirements, preferred textures, incompatible or undesirable ingredients, products and brands used. You can optionally add a product photo and a skin photo. A customer account is not required for this. Images are technically processed before storage; Embedded metadata, such as EXIF capture information, will be removed.

The request is received through our own application and sent to the email inbox dedicated to Thu and the processing of the consultation. Your email address is used for personal reply. Reception and email service providers process the data required for delivery and mailbox operation. The photos on “Frag Thu” are for personal viewing; This consultation route does not transmit it to the AI ​​skin analysis. A submission will not be published automatically and will not sign you up for the newsletter.

The processing of an inquiry relating to a purchase or an existing contract is carried out in accordance with Art. 6 Para. 1 lit. b GDPR. Art. 6 Para. 1 lit. a GDPR applies to the additional processing of voluntary information and photos that you expressly allow; for health data, additionally Art. 9 Para. 2 lit. a GDPR. For other general contact inquiries, the legitimate interest explained in the contact sections above applies in accordance with Article 6 (1) (f) GDPR.

The shipping queue removes the message, reply address and photos after confirmed handover to the mail server, or if no handover occurs, at the latest after seven days in the ongoing cleanup process. Technical process and shipping records, including test values ​​to avoid multiple shipments, are stored there for a maximum of 30 days. These deadlines refer to the shipping queue. The message, replies and attachments that have already been delivered in the advice mailbox will not be deleted. Retention for these depends on how long they are needed to process and complete your request; Afterwards, only any necessary legal storage or proof purposes apply. Photos that are no longer required must be separated from such documents and deleted.

Using your query or images in a public question and answer post is different from private advice. Personal content may only be published based on separate consent; Alternatively, actual anonymization can be considered. Consent to private advice does not include publication on the website or in social networks.

6. AI skin analysis and “My analyzes”

The AI skin analysis is an independent offer. To assign a purchase or other analytics eligibility, Shopify customer ID, order and item IDs, payment, refund, and eligibility status are processed. After your registration and the expressly confirmed analysis order, our application processes your uploaded skin photo, the technical order, the consent version as well as the results and result images generated by the analysis service. This may include values and image markings, in particular for redness, pores, skin texture and the moisture pattern estimated by the model, as well as other evaluation values provided by the service.

The photo is technically normalized and cleaned of embedded metadata before submission. Our application transmits the image and the technical file and order data required for evaluation to Perfect Corp on the server side. / YouCam API. Name, email address, order number and answers from the personal consultation will not be sent with this analysis call. However, a facial image remains personal even without this additional information; removing metadata does not anonymize it.

The order, authorization and service management is based on Art. 6 Para. 1 lit. b GDPR. The voluntary processing of the skin photo and the personal evaluation derived from it is based on Art. 6 Para. 1 lit. a GDPR and, as far as health data is concerned, additionally on your express consent in accordance with Art. 9 Para. 2 lit. The photo analysis cannot be carried out without a suitable photo and the necessary consent. Your legal rights if a service is not provided remain unaffected.

External analysis service: Perfect Corp. declares in its API data protection information to process API inputs and results as a processor according to instructions. The servers mentioned there are located in the USA; International support and technical teams may be involved. The provider states that the general retention period is 30 days after completion of use, with exceptions in particular for legal obligations and legal claims. The 90-day period that applies to us is independent of this. The provider's contact address is [email protected]; The EU representative is Perfect Corp., 55 Boulevard Pereire, 75017 Paris, France. Details can be found in the YouCam API privacy policy.

Processing as a processor requires an agreement in accordance with Art. 28 GDPR. For the transfer to the USA, the requirements of Article 44 ff. GDPR must also be met, for example through an adequacy decision applicable to the specific recipient or suitable guarantees in accordance with Article 46 GDPR, including any necessary additional protective measures. A European contact person for the provider does not mean that the image processing takes place within the EU. Consent to the photo analysis and the provider's general data protection page do not replace the necessary contractual protection.

Photo and evaluation are kept available for retrieval in our own application for up to 90 days from the start of the analysis order. They are then no longer accessible via the application and are removed from the active image and result storage in the associated cleanup process. You can delete completed orders early via “My Analyzes”. Immediate self-service deletion is technically blocked during an ongoing order; You can withdraw your consent and request deletion at [email protected] at any time. Transmissions that have already been made cannot be reversed; A necessary deletion request to the processor must be processed in addition to the deletion of our own copy.

Retrieving private results and images requires the associated registered customer account. A copied result link alone does not authorize another person to access it. Order, payment, consent and voucher receipts may continue to exist separately after the images have been removed, to the extent that they are necessary for the purposes described in Section 12. Deleting an image is not an automatic refund or declaration of withdrawal from the contract.

7. Analysis codes, promotions and care vouchers

To issue and redeem personal analysis codes and care vouchers, we process the assignment to the customer account and, if applicable, to the order, the code, its origin from a purchase or a promotion, issue and expiry times as well as redemption, shipping, blocking and refund status. For promotional codes, the promotion, its quota and the use made for each customer account are also taken into account. The data is used to provide promised benefits, assign them to authorized accounts and prevent multiple or unauthorized redemption.

The provision of a promised advantage takes place in accordance with Article 6 Paragraph 1 Letter b GDPR. Additional security and misuse checks are based on Art. 6 Para. 1 lit. f GDPR with our legitimate interest in correct and tamper-proof redemption. The associated order email address is used to deliver a personal code by email. Such a service message does not sign you up for the newsletter. Vouchers are also assigned to the authorized customer account for redemption at Shopify; Skin photos are not required for discount verification.

The displayed validity period of a code or voucher must be distinguished from the data protection retention period. After expiry, limited proof of issue, redemption or blocking may still be required, for example to process a complaint, to prevent repeated use or due to legal retention requirements. This does not give you permission to continue saving photos or complete analysis results that are no longer needed.

8. “Before & After / Skin Stories”

When you submit a skin story, we process both photos, your chosen display name, your email address, the topic, the time period specified and your testimonial. In addition, there is the consent version, times of receipt and processing status. Embedded image metadata is removed during technical processing. The function is aimed at adults who are depicted in the submitted images and who have the necessary image rights.

The submission is initially stored in our own database and is only accessible to those authorized to review it. Publication will only take place after editorial approval. The shared photos, your chosen display name, topic, period and experience report appear publicly. Email addresses and internal consent or audit protocols are not published by this gallery. A pseudonym does not prevent you from being recognized by your face or description.

The voluntary examination and publication are based on Art. 6 Para. 1 lit. a GDPR; If images or reports contain health data, express consent is also required in accordance with Article 9 Paragraph 2 Letter a of the GDPR. Internal release and security protocols serve to ensure the traceability of moderation decisions and to protect against unauthorized changes in accordance with Article 6 (1) (f) GDPR. Submission does not grant general permission to use your images for newsletters, advertising, social media, or AI training.

Published content is available worldwide and may be stored by third parties, shared or collected by search engines. You can withdraw your consent at any time with future effect via [email protected]; If possible, please mention the display name and the affected post. We remove the affected content from our publication and process the deletion of the underlying data. Required limited evidence may continue under paragraph 12. Copies that have already been made independently by third parties cannot be completely retrieved; our legal obligations, in particular from Art. 17 Para. 2 and Art. 19 GDPR, remain unaffected.

Contributions that have not been published will only be retained for as long as they are required to be examined, any queries raised or legitimate objections clarified. Rejection is not a reason for indefinite storage. Approved contributions remain stored for the respective publication purpose until this no longer applies or the underlying consent is effectively withdrawn.

9. K-Beauty Academy, Cozy K-Game and Browser Storage

In the version currently provided, the K-Beauty Academy saves the learning status in the local storage of your browser (Local Storage). This includes the course and its content status, the topics covered, positions within the learning route, answers, quiz attempts, results and conclusions. The technical storage key is “bns.academy.theme-guest.v1”. The current public configuration does not transfer this learning status to your customer account. Later account synchronization requires appropriately supplemented information when introduced.

The Cozy K-Game processes the current game status in the browser and saves the personal best under “cozy-k-game-best-v1” in the local storage. The best game value is not transferred to our server as a ranking list through your own game function. There is no fixed automatic expiration period for these two local saves. They generally remain until you delete the website data in your browser or the browser removes them. Other people with access to the same browser profile may be able to see the saved status. Deleting may result in learning progress or best values no longer being able to be restored.

Saving or reading information on your device is governed by Section 25 TDDDG. Without separate consent, this is only permitted if it is absolutely necessary for a function you have expressly requested, for example to continue a learning path you have started with your saved progress. Consent is required in accordance with Section 25 Paragraph 1 TDDDG for any further, long-term storage that merely increases convenience. To the extent that personal data is processed, Art. 6 Para. 1 lit. b GDPR applies to the required provision and Art. 6 Para. 1 lit. a GDPR applies to additional voluntary storage. The use of local storage does not constitute permission for analysis or advertising tracking.

The registration for the annual raffle and newsletter offered by the Cozy K-Game must be distinguished from the actual playing. Only when you submit this form will your email address and the assignment to the Cozy K-Game or year of participation be transmitted to Shopify. The game function does not transfer your best score as proof of participation. Information regarding the implementation of the raffle will be processed to process participation in accordance with Article 6 (1) (b) GDPR; Use of the newsletter requires the effective consent required in accordance with Article 6 Paragraph 1 Letter a of the GDPR. The above newsletter information applies to sending the newsletter. You can withdraw your newsletter consent at any time using the unsubscribe link or by sending us a message.

10. Product suggestions and protection of forms

When “Suggest a product” we process the product link you enter, your email address and the identification as a product request. The request is submitted to us via the Shopify contact form for processing and response. The link entered is not automatically visited by this function or sent to the linked retailer for an external link preview. Please do not use links that contain passwords, personal unlock keys or other confidential information. The legal basis is Article 6 Paragraph 1 Letter b GDPR for a pre-contractual inquiry, and Article 6 Paragraph 1 Letter f GDPR with our legitimate interest in processing product requests. This form does not automatically register you for the newsletter. Retention depends on the completion of the request and any necessary proof or legal retention obligations.

The contact and registration forms provided via Shopify may use the embedded service hCaptcha from Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA, to detect automated access. IP address, browser and device information, time, interactions and the result of a security check can be processed. The purpose is to protect against spam and misuse. The legal basis is Article 6 Paragraph 1 Letter f GDPR with our legitimate interest in secure forms; Section 25 Paragraph 2 No. 2 TDDDG applies to absolutely necessary end device access; consent is required for access beyond this. According to him, Intuition Machines is certified according to the EU-US Data Privacy Framework; Art. 45 GDPR applies to transfers covered by this. Further information can be found in the hCaptcha data protection declaration. In the Shopify technical form flow, entered form data can be temporarily cached in session storage so that it can be restored after a form or validation step; this storage is tied to the browser session.

11. Editorial content, videos and external links

Reading K-Beauty Notes, active ingredient information, award overviews and frequently asked questions does not create an additional skin profile through these content offerings. The general information on website operation and any separately described services that may be used apply. Comments or contacts are additional processing operations initiated by you.

K-Beauty Influencer plays videos provided via our Shopify media delivery. Your own gallery only loads the video file when you open the respective clip. A mere link to the Instagram original must be distinguished from an embedded Instagram post. If you open an external link, its provider receives the connection data resulting from this call and processes it according to its own data protection information.

Where an Instagram post is offered directly embedded, the connection to the Instagram service is established after your approval to load external content or the corresponding marketing consent. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Among other things, the IP address, browser information and the page accessed can be transmitted to Meta and cookies or similar technologies can be used. If you already have an Instagram login, Meta can assign the view to your account; Transfers to the USA are possible. The above information on meta and third-country transfers as well as the Instagram data protection information apply to this. The legal basis for voluntary integration is Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TDDDG. You can withdraw a consent granted for the current page visit by reloading the page; Any saved marketing consent must also be withdrawn in the data protection settings.

12. Own Application, Storage, Security and Your Rights

Our own routine, consulting, gallery and analysis application is technically provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The hosting service provider processes the data and technical connection data stored there to provide the application. Shopify processes the data required for shop operations, registration, customer fields, orders and discount allocation. Depending on the function selected, the email, security and analysis service providers mentioned above are added. Information about Hetzner can be found in its data protection information; The international data flows described for Shopify remain to be observed. Access to non-public tool data is only granted to people who need it for the respective processing or technical support.

Security and process data such as customer or request IDs, times, consent versions, check values, error messages, moderation decisions and redemption status are used in particular for authentication, the avoidance of multiple executions, protection against misuse and traceability. For necessary proof of consent, Art. 6 Para. 1 lit. Health data may not be retained solely based on a general legitimate interest; for use necessary to assert, exercise or defend legal claims, Art. 9 Para. 2 lit. f GDPR comes into consideration.

Unless a fixed period is specified above, retention depends on the duration of the storage or publication purpose you require, the completion of the inquiry or service and the subsequent specific need for legal obligations and legal claims. A saved routine profile remains available for the retrieval you request until you delete it, withdraw your consent or this purpose no longer applies. Required invoice and business documents are stored in accordance with the relevant commercial and tax regulations. Such an obligation does not automatically cover the associated skin photos, complete questionnaires or analysis reports. Backup copies and email backups must be taken into account separately; deletion in the active system does not mean that every backup copy is immediately overwritten. Locked backup copies may only be used for restoration to the extent necessary; Deletions that have already been implemented must be taken into account again.

The rule-based care recommendations and AI evaluations can evaluate personal characteristics and thereby represent profiling within the meaning of Art. 4 No. 4 GDPR. They serve as a non-binding cosmetic guide. These care evaluations do not result in an exclusively automated decision about you with legal effect or a similarly significant impairment within the meaning of Art. 22 Para. 1 GDPR. The selection and evaluation procedures may produce inaccurate or incomplete results. Code and eligibility checks take into account specified purchase, account and promotion conditions; If you believe the blocking is incorrect, you can ask us to check it personally.

You can withdraw your consent at any time with future effect. The lawfulness of the processing carried out up to that point on the basis of consent remains unaffected. A message to [email protected] is enough; The use of a specific wording or a specific form is not necessary for this. If possible, please name the offer in question so that we can allocate your request. We only request the additional information necessary for secure identity verification. The rights to information, correction, deletion, restriction, data portability, objection and complaint explained in this data protection declaration also apply to all tool data described here.

Objection: If processing is based on Art. 6 Para. 1 lit. f GDPR, you can object to it for reasons of your particular situation in accordance with Art. 21 Para. 1 GDPR. You can object to processing for direct advertising at any time without giving any such reasons. Revoking data protection consent, withdrawing publication and revoking a purchase contract are different explanations; You can combine these in one message. Your statutory consumer rights are not restricted by this data protection notice.